CVE-2026-46650 in Joplin
Summary
by MITRE • 09/22/2026
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Joplin versions prior to 3.7.2 represents a significant cross-site scripting risk stemming from inadequate input validation within the application's HTML rendering engine. Specifically, the function responsible for validating internal resource URLs utilizes an unanchored regular expression that fails to enforce strict boundaries on the URL scheme and path structure. This technical flaw allows attackers to craft malicious hyperlinks containing javascript: URIs with a specific 32-character path fragment that bypasses the validation logic. Because the regex does not anchor the match to the start or end of the string, it permits these dangerous schemes to pass through as if they were legitimate internal resources, ultimately resulting in their emission into HTML notes without proper sanitization.
The operational impact of this flaw is particularly severe due to Joplin's sharing capabilities. A low-privileged user on a Joplin Server instance can create and publish such crafted HTML content as a public share link. When another user accesses this shared note, the malicious script embedded in the javascript: URL may execute depending on the browser environment and interaction method. While modern browsers like Chrome and Firefox have implemented security measures that block automatic navigation via javascript: URIs during standard left-click events or new-tab openings, execution can still be triggered through specific user interactions such as middle-clicking a link or explicitly selecting open in new tab in older or less hardened browser configurations. This partial mitigation means the vulnerability remains exploitable against users employing legacy software or those who inadvertently trigger navigation through non-standard interaction patterns.
Upon successful execution, the malicious script operates within the security context of the Joplin Server origin rather than a sandboxed environment. This grants the attacker significant privileges relative to the victim's session state. The script can read content that is visible on the page and, crucially, make authenticated same-origin requests if the victim is currently signed into their account. This capability allows for potential data exfiltration of sensitive notes or unauthorized actions performed under the victim’s identity, effectively compromising confidentiality and integrity within the note-taking application. The attack vector aligns with CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting vulnerability, and maps to MITRE ATT&CK techniques related to client-side code injection and session hijacking through browser-based exploitation.
To mitigate this risk, organizations must ensure that all Joplin Server instances are upgraded to version 3.7.2 or later where the regular expression validation has been corrected to strictly enforce URL scheme restrictions and anchor patterns appropriately. Additionally, administrators should encourage users to maintain updated browsers with current security patches enabled to leverage built-in protections against javascript: URI navigation. Implementing a Content Security Policy that restricts script execution sources can further reduce the impact of any residual client-side injection attempts by preventing unauthorized scripts from running within the application context.